2021 has been a year in the record books for cybercrime. Cyber criminals have been increasingly emboldened by the increase in remote working and have targeted businesses of all sizes that have weak cyber security.
High profile cyberattacks, such as the ransomware attack against Colonial Pipeline in May, make national news. But what about cybercrime being perpetrated against small businesses and individuals? Just because they don’t make the headlines, it doesn’t mean they aren’t happening just as frequently. Hackers take advantage of shared user accounts, weak password requirements, unmanaged backups, and lack of timely patch procedures. Small business owners need to be as vigilant about their company’s cyber security as the large corporations are.
AssetSure asked leading cyber liability insurance broker Brian Thornton, President of ProWriters, to get his expert opinion on what small businesses and individuals can do to reduce cyber risk in simple and cost-effective ways:
Dual Authorization
- (2 signatures) Multiple authorized persons signing checks above certain thresholds
- (2 verifications) Email or Mail and telephonic validation of change of account information for existing vendors, customers, and suppliers. Validation should not be to same email and phone number listed on invoice, which could be compromised. New accounts, including vendor, customers and suppliers should be vetted with supervisor approval.
- (2 users) Distinct persons arranging vs approving ACH and Wire transactions
Secure Email Gateway (SEG)
- This type of software monitors incoming and outgoing emails and provides defense against spam, malicious attacks, and fraudulent content.
- Leading vendors include Proofpoint, Mimecast, and Barracuda.
Multifactor Authentication (MFA)
- MFA is a security measure that requires multiple methods of authentication in order to confirm authorized use. MFA applications include chip and pin numbers, security questions, authorized code input with source of code coming from a unique email or mobile device. MFA is increasingly required by insuring carriers for consideration of cyber insurance. They are requiring MFA for access to email, remote access to network, and for privileged users to access backups, etc.
Password Manager
- Generate and retrieve complex, strong and unique passwords.
Employee Training
- Employee error or omission accounts for greater than 90% of claims. Ongoing training builds a culture of awareness around cyber security.
- Leading vendors include KnowBe4
Domain Keys Identified Mail and Domain Based Message Authentication, Reporting, and Conformance (DKIM & DMARC/SPF)
- Standards that authenticate email an organization’s email server
Addition of MDR Services / Endpoint Protection (EDM)
- Managed detection and response (MDR) services are a great way to maintain a dedicated cyber risk management program through a third-party service without an extensive budget.
- Many MDR services provide 24/7 real-time cyber incident response (IR) and security consulting services.
Cloud Based Backups
- Data stored in a remote server provides real time access in the event of outage, ransomware or other cyber-attack. This is another critical area where insuring carriers are very focused during the underwriting review process. They are typically looking for a 3-2-1 backup strategy where an entity has 3 copies of entity data, production data and multiple backups with one backup segregated from the network – offline or cloud based.
About Brian
Prior to his current role at ProWriters, Brian spent two decades in the insurance industry in claims, underwriting, and leadership roles for Hiscox Inc., Chubb and AIG. Brian is a specialist in Cyber Liability risks.
